I have kept every message, invoice and document, which I gather is the useful habit.
I have read the obvious sources and they disagree with each other, so I would rather ask people who have actually done this.
I have a working setup and a notebook, and I am prepared to be told that my setup is inadequate if that is the answer.
So: what is the actual procedure, and which steps matter as opposed to being ritual?
Answer first: the practical privacy question is what a payment record reveals and to whom, and the answer differs by method more than most people assume.
Keep your own record of every transaction regardless of method: date, amount, reference, and what was ordered. This is the documentation you will need if anything requires resolving.
Bank transfers create a record with both banks, generally have no reversal mechanism once settled, and are the method with the least recourse for the most traceability — the worst of both.
Customer identification requirements at regulated exchanges create the identity linkage that makes on-chain analysis effective.
No payment method makes an unlawful act lawful, and privacy is not a defence.
Public chains are permanent and searchable. Pseudonymous is not anonymous.
Analytical standards and reagents with traceable certificates. Every quantitative result you read inherits the accuracy of the standard behind it.
Shop standardsAnswering this needs to know what is actually being protected against, because the honest answer to a vague concern is usually "less than you think".
Merchant data breaches are the realistic exposure for most people, and the mitigation is minimising what the merchant holds rather than choosing an exotic payment rail.
Put another way, using a dedicated email address per merchant makes any subsequent breach traceable to its source and costs nothing to set up.
Merchant payment-data breaches are a well-documented and recurring exposure across e-commerce generally.
Nothing here is medical advice either, and research-use compounds are not approved for human use.
A dedicated email address per merchant is free and genuinely useful.
edited 12 Jul 2026 by pk_curve — added the placebo-arm figures
The short version: every method leaves a record somewhere, the records differ in who holds them and for how long, and none of them is anonymous.
Public blockchain transactions are permanent, globally readable and linkable. Chain analysis routinely deanonymises addresses through exchange on-ramps, and the record does not expire.
Whatever a merchant says about not storing details, assume they do. Design around the assumption rather than the assurance.
The caveat is that legal exposure varies enormously by jurisdiction and nothing here is legal advice.
Decide what you are protecting against first. Most of this question dissolves at that step.
The relevant point is that chargeback protection and privacy pull in opposite directions, and you cannot have both.
Card payments create a record with the issuer, the acquirer and the merchant, and they carry a chargeback mechanism. That mechanism is the only consumer recourse in this entire space and it is not nothing.
Card scheme chargeback rules are published and provide a defined dispute mechanism with time limits, which no other common method offers.
Keep your own records whatever you use. You will need them.
Start with the threat model. Protecting against a data breach at a merchant and protecting against anything else are different problems with different answers.
Any method routed through a regulated exchange creates identity records at that exchange under standard customer-identification requirements, which is where most linkage actually happens.
Public blockchains are permanent and publicly readable by design; pseudonymity is not anonymity and the distinction is well documented in the chain-analysis literature.
A chargeback is the only recourse mechanism in this space. Price that in.
Ask PeptideStack is a static archive. Posting is closed, but the norms are worth stating: answer the question that was asked, show your working, cite the trial or the certificate, and say plainly where the evidence runs out.